PT-2022-6746 · Google+3 · Protobuf-Java+4

Published 2022-09-29 · Updated 2025-04-22 · CVE-2022-3509

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions protobuf-java core and lite versions prior to 3.21.7 protobuf-java core and lite versions prior to 3.20.3 protobuf-java core and lite versions prior to 3.19.6 protobuf-java core and lite versions prior to 3.16.3

Description A parsing issue in protobuf-java core and lite can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields cause objects to be converted back-and-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. The issue is related to errors in resource release.

Recommendations For versions prior to 3.21.7, update to version 3.21.7 or later. For versions prior to 3.20.3, update to version 3.20.3 or later. For versions prior to 3.19.6, update to version 3.19.6 or later. For versions prior to 3.16.3, update to version 3.16.3 or later.

Fix

DoS

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

BDU:2023-03851

CVE-2022-3509

GHSA-G5WW-5JH7-63CX

Affected Products

Astra Linux

Debian

Jira

Jira Service Management Server

Protobuf-Java

References · 26

• https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3509 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3509 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03851 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=270939041 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3509 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3509 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3509 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3509 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/protobuf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3509 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5ww-5jh7-63cx · Vendor Advisory